Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: MyGate Network Node

CRITICAL RISKRemoved from Chrome Web Store

MyGate Network Node

ID: hajiimgolngmlbglaoheacnejbnnmoco

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.0.23

Size

0.64 MB

Rating

4.3/5

Reviews

186

Users

200,000

Type

Extension

Updated

Jan 25, 2025

Publisher Contextual Analysis

Author: Mygate networkView Profile
Privacy: Privacy Policy
MX records exist: No
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: No

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

200,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

This app allows users to share their network bandwidth with others and earn points as rewards.

This app allows users to share their network bandwidth with others and earn points as rewards. By connecting to the app, users contribute their unused internet resources to a decentralized network. In return, they receive points that can later be swapped for tokens or other benefits within the platform.

User Growth

Showing data from Dec 19, 2024 to Jun 12, 2025

Versions

-33.33%(-100,000 users)

Compared to 3 months ago

18 versions released in this period

Rating Count

Total: 352 ratings

Average Rating

Current: 4.28 / 5.0+4.28

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High6

Medium2

Low1

Versions scanned

Showing 2 of 18 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.19 Code review	5
1.0.0 Code review	4

Extension Version	Code Review Findings
1.0.19	5
1.0.0	4

Files with findings

3 distinct paths — top paths by unique finding count:

background.js5
content.js2
main.js2

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	high	content.js (line 1)	This content script continuously polls the page's localStorage every 100 ms, extracts the persisted auth blob, and forwards it to the extension background page. Pulling bearer-token material from a website's client-si…	1.0.19
2	Credential Theft	high	background.js (line 1762)	The background worker receives the auth blob harvested by the content script, parses out the token, and persists it in extension storage. Storing a website session token inside extension-controlled storage expands its…	1.0.19
3	Credential Theft	high	background.js (line 1)	The background script receives the full serialized Redux state dumped from localStorage, parses it, extracts the authentication bearer token from the `auth` slice, and persists it to `chrome.storage.local`. This token…	1.0.0
4	Data Exfiltration	high	background.js (line 1674)	This code takes the previously captured bearer token and a persistent device identifier and uses them to establish a long-lived Socket.IO connection to the remote API. Maintaining a background-authenticated channel wi…	1.0.19
5	Other	high	background.js (line 1)	Immediately on install/startup the background service worker establishes a persistent Socket.IO connection to `api.mygate.network` authenticated with the harvested bearer token, registering the browser as a `nodeId`-i…	1.0.0
6	Unauthorized Data Collection	high	content.js (line 1)	The content script immediately reads the entire Redux Persist store (`persist:root`) from localStorage on the MyGate web app and transmits the complete serialized application state to the background service worker. Th…	1.0.0
7	Tracking	medium	main.js (line 13835)	The popup generates a stable UUID, stores it as `device_id`, and registers that identifier with the backend as a node. This is a persistent tracking mechanism tied to the user's account/session and background connecti…	1.0.19
8	Unauthorized Data Collection	medium	main.js (line 1)	The popup UI's Axios instance silently reads the token from `chrome.storage.local` on every request and injects it as a Bearer authorization header to `https://api.mygate.network/api/front`. On a 401 response it remov…	1.0.0
9	Other	low	background.js (line 1747)	On every browser startup, the extension automatically opens a new tab to its website. Forced tab creation is not outright malicious by itself, but it is an intrusive behavior commonly associated with adware/growth-hac…	1.0.19

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


socket.io	/docs/v3/migrating-from-2-x-to-3-0/	https://socket.io/docs/v3/migrating-from-2-x-to-3-0/
api.mygate.network	-	https://api.mygate.network
api.mygate.network	/api/front/metadata/nodes/$%7Bn%7D%60;try%7Bconst	https://api.mygate.network/api/front/metadata/nodes/${n}`;try{const
app.mygate.network	-	https://app.mygate.network
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
reactjs.org	/docs/error-decoder.html	https://reactjs.org/docs/error-decoder.html?invariant=
www.w3.org	/XML/1998/namespace	http://www.w3.org/XML/1998/namespace
www.w3.org	/1998/Math/MathML	http://www.w3.org/1998/Math/MathML
www.w3.org	/1999/xhtml	http://www.w3.org/1999/xhtml

Showing 1 to 10 of 30 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

2.2 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

scam

Shan Muhammad Ghallu·2 Jun 2025

scam.........

amy soul·23 May 2025

scam project guys

Amit Sharma·23 May 2025

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

MyGate Network Node

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 18 Versions9

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating